CVE-2026-40492

The record

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on `pixmap_depth` but the byte-swap code uses `bits_per_pixel` independently. When `pixmap_depth=8` (BPP8_INDEXED, 1 byte/pixel buffer) but `bits_per_pixel=32`, the byte-swap loop accesses memory as `uint32_t*`, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed `bytes_per_line` validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.

Affected packages

Related vulnerabilities

• CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli… CWE-787
• CVE-2026-112397 Pillow is a Python imaging library. CWE-787
• CVE-2026-112059 libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point… CWE-787
• CVE-2026-89088 A flaw was found in parted. CWE-787
• CVE-2026-89085 A flaw was found in parted. CWE-787
• CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. CWE-787
• CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. CWE-787
• CVE-2026-56851 The Nickname profile can panic with an out-of-bounds slice error when transforming… CWE-787